CVE-2026-64863 in goshs
Summary
by MITRE • 07/29/2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The goshs HTTP server implementation contains a critical authorization flaw in its WebDAV MOVE operation handling that affects versions prior to 2.1.4. The vulnerability stems from improper enforcement of the --no-delete command-line flag within the httpserver/server.go wdGuard component, which processes WebDAV operations with write-only permissions. This oversight creates a privilege escalation vector where authenticated WebDAV clients can bypass intended access controls and perform destructive operations on the file system.
The technical flaw manifests when the server processes MOVE requests with the Overwrite: T header parameter, allowing remote attackers to overwrite existing files or delete content without proper authorization. The wdGuard implementation incorrectly assumes that write-only operations inherently prevent deletion, failing to validate whether the --no-delete flag has been explicitly set by administrators. This misconfiguration creates a path for malicious actors to exploit the server's WebDAV interface and execute unauthorized file manipulation operations.
From an operational perspective, this vulnerability poses significant risk to red team environments where goshs serves as a lightweight file server for penetration testing activities. Attackers could leverage this flaw to remove critical test files, overwrite legitimate content, or establish persistence mechanisms by deleting and recreating files with modified permissions. The impact extends beyond simple data loss as the vulnerability can be exploited to disrupt ongoing security assessments or compromise the integrity of test environments that depend on goshs for file serving capabilities.
The vulnerability aligns with CWE-284 (Improper Access Control) and represents a failure in implementing proper authorization checks within WebDAV operations. According to ATT&CK framework, this issue maps to T1078 (Valid Accounts) and T1566 (Phishing for Information) as it enables attackers who have gained access to the server to escalate privileges through unauthorized file manipulation. Organizations using goshs in security testing environments should immediately upgrade to version 2.1.4 or later where the fix properly enforces the --no-delete flag during WebDAV MOVE operations.
The mitigation strategy involves implementing proper input validation and authorization checks for all WebDAV operations, ensuring that the --no-delete flag is consistently enforced regardless of operation type. System administrators should also implement network segmentation and access controls to limit exposure of WebDAV endpoints to trusted networks only. Additionally, monitoring for unusual WebDAV activity patterns and implementing automated alerting for file deletion or overwrite operations can help detect exploitation attempts before they cause significant damage to security test environments.